Methods and systems for distributed computation within a fully homomorphic encryption scheme using p-adic numbers

ABSTRACT

Disclosed are methods and systems to provide distributed computation within a Fully Homomorphic Encryption (FHE) system by using g-adic properties to separate a ciphertext into multiple ciphertexts for each Hensel digit level. A number t of computation units may individually perform addition and/or multiplication of each Hensel digit level on each of the computation units and then reconstruct the resulting value from the result ciphertext of each computation unit using p-adic and g-adic operations. Accordingly, computation burdens may be distributed to several computation units.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is based upon and claims the benefit of U.S. provisional application Ser. No. 63/079,676, filed Sep. 17, 2020, entitled “p-adic Numbers and Applications to Cryptography,” all of which is also specifically incorporated herein by reference for all that it discloses and teaches.

BACKGROUND OF THE INVENTION

The advancement of science is possible when knowledge is shared and information is exchanged in a seamless manner. In a world where many businesses rely on information as their main assets, analysis over data is a crucial competitive advantage. Consequently, the amount of data processed and stored will continue to increase, creating a demand for virtualized services. To this end, some applications can be provided as cloud computing resources including Internet of Things (IoT), machine learning, virtual reality (VR) and blockchain. As a result, concerns about custody and privacy of data are on the rise.

Modern concealment/encryption employs mathematical techniques that manipulate positive integers or binary bits. Asymmetric concealment/encryption, such as RSA (Rivest-Shamir-Adleman), relies on number theoretic one-way functions that are predictably difficult to factor and can be made more difficult with an ever-increasing size of the encryption keys. Symmetric encryption, such as DES (Data Encryption Standard) and AES (Advanced Encryption Standard), uses bit manipulations within registers to shuffle the concealed text/cryptotext to increase “diffusion” as well as register-based operations with a shared key to increase “confusion.” Diffusion and confusion are measures for the increase in statistical entropy on the data payload being transmitted. The concepts of diffusion and confusion in encryption are normally attributed as first being identified by Claude Shannon in the 1940s. Diffusion is generally thought of as complicating the mathematical process of generating unencrypted (plain text) data from the encrypted (cryptotext) data, thus, making it difficult to discover the encryption key of the concealment/encryption process by spreading the influence of each piece of the unencrypted (plain) data across several pieces of the concealed/encrypted (cryptotext) data. Consequently, an encryption system that has a high degree of diffusion will typically change several characters of the concealed/encrypted (cryptotext) data for the change of a single character in the unencrypted (plain) data making it difficult for an attacker to identify changes in the unencrypted (plain) data. Confusion is generally thought of as obscuring the relationship between the unencrypted (plain) data and the concealed/encrypted (cryptotext) data. Accordingly, a concealment/encryption system that has a high degree of confusion would entail a process that drastically changes the unencrypted (plain) data into the concealed/encrypted (cryptotext) data in a way that, even when an attacker knows the operation of the concealment/encryption method (such as the public standards of RSA, DES, and/or AES), it is still difficult to deduce the encryption key.

Homomorphic Encryption is a form of encryption that allows computations to be carried out on concealed cipher text as it is concealed/encrypted without decrypting the cipher text that generates a concealed/encrypted result which, when decrypted, matches the result of operations performed on the unencrypted plaintext.

The word homomorphism comes from the ancient Greek language: óμóç (homos) meaning “same” and μoρφ{acute over (η)} (morphe) meaning “form” or “shape.” Homomorphism may have different definitions depending on the field of use. In mathematics, for example, homomorphism may be considered a transformation of a first set into a second set where the relationship between the elements of the first set are preserved in the relationship of the elements of the second set.

For instance, a map f between sets A and B is a homomorphism of A into B if f(a ₁ op a ₂)=f(a ₁)op f(a ₂)|a ₁ ,a ₂ ∈A where “op” is the respective group operation defining the relationship between A and B.

More specifically, for abstract algebra, the term homomorphism may be a structure-preserving map between two algebraic structures such as groups, rings, or vector spaces. Isomorphisms, automorphisms, and endomorphisms are typically considered special types of homomorphisms. Among other more specific definitions of homomorphism, algebra homomorphism may be considered a homomorphism that preserves the algebra structure between two sets.

SUMMARY OF THE INVENTION

An embodiment of the present invention may comprise a method for distributing an arithmetic computation o across a number t computational units of a private-key Fully Homomorphic Encryption (FHE) system, where t is at least 2, the method comprising: generating by a source device a secret key sk comprised of prime numbers p₁ . . . p_(2t) and public evaluation key pk equal to g of a g-adic number system; choosing by said source device random numbers sa₂ . . . sa_(t) for a message m_(a); computing by said source device rational number α_(a) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes ha₁ . . . ha_(t) where said Hensel codes ha₁ . . . ha_(t) are said message m_(a) and said random numbers sa₂ . . . sa_(t); computing by said source device Hensel codes ha_(t+1) . . . ha_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(a) such that said Hensel codes ha_(t+1) . . . ha_(2t) are message m_(a) ciphertexts ca₁ . . . ca_(t); choosing by said source device random numbers sb₂ . . . sb_(t) for a message m_(b); computing by said source device rational number α_(b) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes hb₁ . . . hb_(t) where said Hensel codes hb₁ . . . hb_(t) are said message m_(b) and said random numbers sb₂ . . . sb_(t); computing by said source device Hensel codes hb_(t+1) . . . hb_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(b) such that said Hensel codes hb_(t+1) . . . hb_(2t) are message m_(b) ciphertexts cb₁ . . . cb_(t); sending by said source device each Hensel digit of said ciphertexts ca₁ . . . ca_(t) and each Hensel digit of said ciphertexts cb₁ . . . cb_(t) to corresponding computational units 1 . . . t, respectively; performing at each computational unit 1 of said computational units 1 . . . t arithmetic function ca_(i) o cb_(i) to obtain encrypted result cr_(i) corresponding to said computational unit i; sending by each of said computational units 1 . . . t said corresponding encrypted result cr_(i) to a destination device; computing by said destination device a result rational number α_(r) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p_(t+1) . . . p_(2t) and the encrypted results cr₁ . . . cr_(t) as Hensel codes for said g-adic number inverse H_(g) ⁻¹; and computing by said destination device a result message m_(r) as Hensel Code Generation H with said prime p₁ and said result rational number α_(r) such that result message m_(r) is equal to arithmetic function message m_(a) o message m_(b).

An embodiment of the present invention may further comprise a private-key Fully Homomorphic Encryption (FHE) system that distributes an arithmetic computation o across a number t computational units, where t is at least 2, the private-key FHE system comprising: a source device, wherein said source device further comprises: a key generation subsystem that generates a secret key sk comprised of prime numbers p₁ . . . p_(2t) and public evaluation key pk equal to g of a g-adic number system; a random number selection subsystem that chooses random numbers sa₂ . . . sa_(t) for a message m_(a) and random numbers sb₂ . . . sb_(t) for a message m_(b); a message value to rational number subsystem that computes rational number α_(a) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes ha₁ . . . ha_(t) where said Hensel codes ha₁ . . . ha_(t) are said message m_(a) and said random numbers sa₂ . . . sa_(t), and computes rational number α_(b) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes hb₁ . . . hb_(t) where said Hensel codes hb₁ . . . hb_(t) are said message m_(b) and said random numbers sb₂ . . . sb_(t); an encryption subsystem that computes Hensel codes ha_(t+1) . . . ha_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(a) such that said Hensel codes ha_(t+1) . . . ha_(2t) are message m_(a) ciphertexts ca₁ . . . ca_(t), and computes Hensel codes hb_(t+1) . . . hb_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(b) such that said Hensel codes hb_(t+1) . . . hb_(2t) are message m_(b) ciphertexts cb₁ . . . cb_(t); a ciphertext Hensel digit send subsystem that sends each Hensel digit of said ciphertexts ca₁ . . . ca_(t) and each Hensel digit of said ciphertexts cb₁ . . . cb_(t) to corresponding computational units 1 . . . t, respectively; said computational units 1 . . . t, wherein each of said computational units 1 . . . t further comprises: an arithmetic function subsystem that performs at each computational unit i of said computational units 1 . . . t arithmetic function ca_(i)ocb_(i) to obtain encrypted result cr_(i) corresponding to said computational unit i; an encrypted result send subsystem that sends said encrypted result cr_(i) that corresponds to said computational unit i of said computational units 1 . . . t to a destination device; and said destination device, wherein said destination device further comprises: a result rational number computation subsystem that computes a result rational number α_(r) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p_(t+1) . . . p_(2t) and the encrypted results cr₁ . . . cr_(t) as Hensel codes for said g-adic number inverse H_(g) ⁻¹; and a Hensel code result message recovery subsystem that computes a result message m_(r) as Hensel Code Generation H with said prime p₁ and said result rational number α_(r) such that result message m_(r) is equal to arithmetic function message m_(a) o message m_(b).

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings,

FIG. 1 is a block diagram of the hardware implementation for a Fully Homomorphic Encryption (FHE) system distributed computation embodiment.

FIG. 2 is a flow chart of operations for a FHE distributed computation embodiment.

DETAILED DESCRIPTION OF THE EMBODIMENTS

1. Introduction

The 1970s and 1980s were very important times for cryptography since it was during this particular period that most of the mathematical ideas for modern cryptography were established. In 1976, Diffie and Hellman proposed methods for key exchange and digital signatures in which the security is related to the discrete logarithm problem in finite fields. In 1978, Merkle introduced a method for secret key distribution based on randomized “puzzles.”. Later in 1978 Rivest, Shamir and Adleman (RSA) introduced a method for obtaining digital signatures and public key cryptosystems, which was later referred to as the RSA cryptosystem, based on the factorization problem. Yet in 1978, McEliece proposed a public-key encryption scheme based on Goppa codes. As noted by Hellman, the aforementioned authors are considered the first publicly known proponents of public-key cryptosystems. Among these, the Diffie-Hellman key exchange and the RSA cryptosystem are of special relevance in the history of cryptography up to present time given they are not only two of the first public-key cryptosystems but also cryptosystems based on number theory. None of the aforementioned works proved secure. In fact, at that point in time, formal definitions of security were not yet in place and some of the schemes proposed (e.g., RSA) were actually demonstrably insecure. However, they are all relevant from a historical standpoint.

In 1985 Miller and in 1978 Koblitz, independently, proposed the use of elliptic curves in cryptography in which it is possible to construct cryptographic protocols based on the elliptic curve discrete logarithm problem. For this reason, it is possible to implement the ideas of Diffie and Hellman with elliptic curves, which is known as elliptic curve Diffie-Hellman, as well as providing a signature scheme with the elliptic curve digital signature algorithm. Many other protocols based on the discrete logarithm problem have been implemented with elliptic curves where all the solutions to cryptography that are based on elliptic curves are identified as elliptic curve cryptography (ECC).

In 1996, Ajtai introduced a class of random problems in lattice theory which are demonstrated to be difficult to solve based on the shortest vector problem, and in 1997 Ajtai and Dwork introduced a public-key cryptosystem based on lattices while showing that the average case of the problems showcased by Ajtai were as hard as the worst-case ones. In 1998 Hoffstein, Pipher and Silverman proposed lattice-ring-based public-key cryptosystem and in 2005 Regev introduced another public-key cryptosystem based on the problem of learning with errors, which can be related to lattice problems. Many authors found lattices a promising mathematical resource for constructing cryptographic solutions and soon enough the term lattice-based cryptography was adopted to identify the set of cryptographic solutions supported by lattice theory. In 2009 Gentry introduced the first fully homomorphic encryption scheme which was based on ideal lattices followed by several other lattice-based variants. As it happened with ECC, lattice-based cryptography is an active field of research.

As can be seen, elliptic curves and lattices are two examples of mathematical resources in which researchers encounter a vastness of opportunities for constructing cryptographic solutions to the extent of creating their own branch of research within cryptography. The various embodiments take advantage of another mathematical resource that is similarly rich, versatile, intuitive and powerful, namely, the p-adic number theory. Although p-adic numbers are somehow present in some cryptographic contexts, it has today a minor role when compared with p-adic number theory's potential of being a major field of research in cryptography. When proposing the use of elliptic curves in cryptography, Miller remarked that his intent was to “show that elliptic curves have a rich enough arithmetic structure so that they will provide a fertile ground for planting the seeds of cryptography.” Analogously, the disclosure of the various embodiments is expected to show that p-adic numbers have a rich arithmetic structure to arouse a growing research interest on p-adic number theory's properties aimed at cryptographic constructions.

1.1 Our Contribution

We propose a modern, self-contained and minimum required elementary introduction to the p-adic number theory with emphasis in a distinct subset of properties and functions that we identify as valuable to cryptography. We provide efficient algorithms for the main mappings within the p-adic arithmetic alongside insights and practical examples of how to use them in the context of cryptography. We propose methods for allowing crypto algorithms over the integers to accept rational numbers. As we approach security concerns in cryptography via p-adic numbers, we introduce methods for adding randomness to deterministic crypto algorithms that can be easily extended to be able to randomize just about any deterministic algorithm. We propose a protocol for distributed computation where any input can be transformed into an arbitrary number of p-adic digits where number k of parties perform a joint computation, each one on their individual digit without having any knowledge of what that digit represents and what the other digits are. In a similar approach we propose methods for aiding parallel computation and we demonstrate how to parallelize a given function in terms of p-adic digits. By combining properties of our discussed constructions, we introduce a fully homomorphic encryption (FHE) scheme and we show its connection with the prime factorization and the discrete logarithm problem from a Hensel's lemma perspective.

1.2 Related Work

In 1817, Kurt Hensel introduced the p-adic number theory and since then it has been studied as part of Number Theory, however, it was only in the 1970s and 1980s that this branch of mathematics had any traction due to the work of Krishnamurthy, Rao, and Subramanian, and Alparslan when they found that the finite segment of the p-adic arithmetic was an efficient solution for error-free computation. During this period, other researchers became interested in error-free computation via p-adic numbers and helped to consolidate the finite segment p-adic number theory for practical applications in several areas of physics, engineering and computer science. The subject rapidly advanced with the contributions of Gregory, Beiser, Farinmade, Hehner and Horspool, and Lewis, among others. The practical implications of working with the finite p-adic arithmetic for error-free computation were so vast that Rao remarked that would not need to have a complete understanding of the theoretical aspects of p-adic numbers in order to work with its finite segment, since the theory of the finite segment p-adic had become a well-organized and a nearly self-sufficient subset of the theory of p-adic numbers. Krishnamurthy, Rao, and Subramanian named the finite-segment p-adic numbers as Hensel codes. Along-side with error-free computation, p-adic numbers have been successfully applied to parallel computation. The theory of p-adic numbers is currently present in many other theories, including the theory of dynamical systems, theoretical physics, number theory, algebraic geometry, non-Archemdian analysis, differential calculus, topology, and analytic functions.

2. p-adic Numbers

Let p be prime. Any positive integer x can be represented uniquely as an expansion of the form x=a₀+a₁p+a₂p²+ . . . +a_(n)p^(n) for some n, where a_(i) is an integer with 0≤α_(i)≤p. That is, a₀+a₁p+a₂p²+ . . . +a_(n)p^(n) is the base-p representation of x. One of Hensel's main motivations was to relate the integers

to the field of rationals

, which gives rise to the p-adic number system. In the p-adic number system, all rational numbers in the field of rational numbers

are represented as unique infinite expansions α=a_(i)p^(i), where i is an integer and the value for any given a_(i) is in the range [0, p−1]. In this work we focus our attention on the finite-segment p-adic number theory and from now on we discuss its foundation, main properties and opportunities for possible practical applications.

2.1 Hensel Codes

Gregory and Krishnamurthy remarked that there are a large number of ill-conditioned problems as well as numerically unstable algorithms in which cases rounding errors cannot be tolerated during computation. As one approach to solve this problem one might apply finite number systems (also known as residue number systems or RNS) in which one is able to perform computations free of rounding errors. The most common RNS number systems are probably the single-modulus and multiple-modulus. In this section we discuss another method to achieve error-free computation with truncated infinite p-adic expansions known as Hensel Codes (see Definition 3 below). Hensel's Lemma showed that increasing the number of terms in a p-adic expansion is equivalent to finding a unique integer root for a larger power of p. In the finite-segment p-adic number system, each rational number in a given finite set of

is mapped to a unique integer root that will be referred to as an integer Hensel code. Computations performed over Hensel codes are mathematically equivalent to computations performed over their corresponding rational numbers, which was shown with infinite p-adic expansions; however, there are some special considerations to preserve uniqueness and correctness when working with the truncated expansions. The finite-segment p-adic arithmetic, as a type of RNS, is free of rounding errors.

Definition 1. A residue number system (RNS) is a numerical system in which an integer x∈{0, . . . , M−1}, where M=Π_(i=1) ^(k)m_(i), is uniquely represented in terms of its congruences with a set of k distinct and pairwise coprime moduli {m_(l), . . . m_(k)}, which generate a set of k remainders {x₁, . . . , x_(k)} such that x_(i)=x mod m_(i) and 0≤x_(i)≤m_(i), for i=1 . . . k, such that there is a ring isomorphism guaranteed by the Chinese Remainder Theorem (CRT).

A p-adic expansion is a summation of the form Σ_(i=k) ^(∞)α_(i)p^(i), with α_(i) ∈{0, . . . , p−1}. Any p-adic expansion naturally gives rise to the sequence of partial sums (α_(n)) where α_(n)=Σ_(k=k) ^(n) m_(i). Note that this is always a Cauchy sequence with respect to the p-adic absolute value, and so every p-adic expansion can be said to converge to an element of p. A p-adic expansion is finite if it contains only a finite number of non-zero p-adic digits. Given a prime p, let an element h in

_(p) that represents a rational α be a p-adic digit. In integer representation, if multiple primes are used to encode α, say (p_(i), . . . , p_(k)), then α is represented by multiple p-adic digits (h₁, . . . , h_(k)) where h_(i)∈

_(p), i=1 . . . k.

Definition 2. For any prime p, the finite-segment p-adic number system is the replacement of the arithmetic over the rational numbers by the arithmetic over the integers modulo p.

Theorem 1. The finite-segment p-adic number system is a RNS (residue number system).

Proof. It is easier to prove the finite p-adic number system as a RNS for k p-adic digits where k≤1. However, we generalize it as follows: consider a k-digit Hensel code, for k≥1, and g=Π_(i=1) ^(i)p_(i). The Hensel code of a=a/b encoded with g is an integer x=ab⁻¹ mod g, for x∈{0, . . . , g−1}, such that each individual Hensel digit corresponding to each p_(i) in g is computed as: (h ₁ , . . . h _(k))=(x mod p ₁ , . . . x mod p _(k)).  Eq. 1

For the particular case where k=1, it is obvious that h=x mod p.

Remark 1. Arithmetic in the finite-segment p-adic number system is equivalent to the single-modulus RNS if the single modulus is an integer of the form m=p^(r) where p is a prime number and r is an arbitrary positive integer.

Definition 3. The r-order Hensel code of a rational number α is the truncation of the p-adic expansion of α to r digits. We write this as H (p, r, α).

Theorem 2 shows one approach for mapping to Hensel codes. The method finds the partial sum of an infinite p-adic expansion, converts it to radix-p form, and reverses the order of the digits.

Theorem 2. For all α=a/b in

there is a n∈

such that we can rewrite a/b as:

$\begin{matrix} {\frac{a}{b} = {\frac{c}{d}p^{n}}} & {{Eq}.\mspace{14mu} 2} \end{matrix}$ where gcd (c, d)=gcd (c, p)=gcd (d, p)=1. (gcd—greatest common denominator) We can then write the Hensel code for c/d as: H(p,r,c/d)=a ₀ a ₁ . . . α_(r−1),  Eq. 3 where α_(r−1) . . . a₀a₁ is the base p representation for the integer cd⁻¹ mod p^(r). In other words, cd ⁻¹ mod p ^(r) =a ₀ +a ₁ p+a ₂ p ²+ . . . α_(r−1) p ^(r−1).  Eq. 4

Proof. Let c/d be computed by the following p-adic expansion:

$\begin{matrix} {\frac{c}{d} = {{\sum_{j = 0}^{\infty}{a_{j}p^{j}}} = \ {\left( {a_{0} + {a_{1}p} + \ldots + {a_{r - 1}p^{r - 1}}} \right) + {p^{r}{R_{r}.}}}}} & {{Eq}.\mspace{14mu} 5} \end{matrix}$ Then we write c=d(a₀+a₁p+ . . . +α_(r−1)p^(r−1))+p^(r)(dR_(r)). Then, c mod p ^(r) =d(a ₀ +a ₁ p+ . . . +α _(r−1) p ^(r−1))mod p ^(r),  Eq. 6 which implies: cd ⁻¹ mod p ^(r) =a ₀ +a ₁ p+ . . . +α _(r−1) p ^(r−1),  Eq. 7

Example 1. Consider α=8/3∈

, r=4, and p=5. Find the partial sum corresponding infinite p-adic expansion.

$\begin{matrix} {{{cd^{- 1}{{mod}p}^{r}} = {{8 \cdot 3^{- 1}}{{mod}625}}}\begin{matrix} {= {{8 \cdot 417}{{{mod}625}.}}} \\ {= {3336{{{mod}625}.}}} \\ {= 211} \end{matrix}} & {{Eq}.\mspace{14mu} 8} \end{matrix}$ The sum of the truncated expansion is 211 in base 10, which is 1321 in base 5. Reversing the order of the digits and placing a p-adic point gives α=0.1231.

Example 2. Consider the two rational numbers α=¾ and β=381/76 mapped to

₃. The Hensel codes with r=4 are given below. H(p=3,r=4,α=3¹(¼))=3¹[(1·61)mod 81]=16  Eq. 9 H(p=3,r=4,β=3¹(127/76))=3¹[(127·16)mod 81]=16  Eq. 10 Verify,

$\begin{matrix} {{{ad} = {{cb}{mod}p}^{r}}{{228} = {{1524{{mod}81}} = 66}}} & {{Eq}.\mspace{14mu} 11} \end{matrix}$

The resulting Hensel codes are identical, which illustrates that uniqueness is no longer valid for every a α

_(p) in the finite-segment number system. As a result, a finite set of

_(p) is defined to ensure uniqueness and correctness for Hensel codes, and arithmetic on Hensel codes. The set of order-N Farey fractions, originally denoted by

_(N), is classically defined in various texts. However, we propose new notation and a new definition for the order-N Farey fractions with respect to a prime p which is consistent with the applications of p-adic numbers throughout this work. But before introducing the new notation and new definitions we will discuss the basics of the mapping between order-N Farey fractions and Hensel codes over the integers.

2.2 Hensel Code Mappings Over the Integers

Section 2.1 showed two different methods for obtaining a Hensel code. In this section, we introduce the integer Hensel code, which is simply the partial sum of the truncated p-adic expansion. All previous examples with infinite p-adic expansions showed that given enough terms, the convergence for an expansion is found by arranging the terms as a geometric series. However, if enough terms are not given, a truncated p-adic expansion cannot be represented as a geometric series, which calls for an alternative method to solve for convergence of an integer Hensel code to the corresponding rational number in

. The Extended Euclidean Algorithm (EEA) is one method to obtain the corresponding rational number.

From this point on, we will consider an isomorphic mapping between the order-N Farey fractions and a corresponding set of Hensel codes with respect to p^(r) for r=1. Thus, we will suppress r in the notation for clarity. The reason for this decision will be discussed next.

Theorem 3. Given α=(regular a/b and p such that a, b, and p are pairwise coprime, and |a|, |b|<p there is a unique value of h=H (p, α), h<p which is computed as follows: h=H(p,α)=ab ⁻¹ mod p,  Eq. 12 where b⁻¹ is the modular multiplicative inverse of b with respect to p.

Proof. The computation of h as in Eq. 12 is fairly intuitive. Recall that any rational number a/b can be rewritten as a·b⁻¹=a·1/b. However, while working with arithmetic mod p, we compute a·b¹ mod p such that b⁻¹ is the only integer that satisfies b·b⁻¹ mod p=1. The value of a can be obtained from h by solving a=bh+kp, where k=(a−bh)/p. This is a Diophantine equation which can be solved by the EEA. We thus have a=bh+kp and b=(a−kp)/h and therefore h can be alternatively computed as h=(a−kp)/b.

Definition 4. A convergent is a rational number obtained via a limited number of terms in a continued fraction and it is typically denoted by p_(n)/q_(n) for n convergents of a rational number x where p_(n)/q_(n) is the n-th convergent of x.

Kraeft remarked that every irreducible rational number a/b which satisfies the inequality:

$\begin{matrix} {{{\frac{c}{d} - \frac{a}{b}}} < \frac{1}{2b^{2}}} & {{Eq}.\mspace{14mu} 13} \end{matrix}$ is convergent of c/d.

Lemma 1. For all p/q, x∈

, if

$\begin{matrix} {{{{x - \frac{p_{n}}{q_{n}}}} \leq \frac{1}{q_{n}q_{n + 1}} < \frac{1}{q_{n}^{2}}},} & {{Eq}.\mspace{14mu} 14} \end{matrix}$ then p/q is a convergent of x.

Proof. In order to find the distance between a convergent

$\frac{p_{n}}{q_{n}}$ of a continued fraction and the fraction itself x, we begin by establishing,

$\begin{matrix} {\left\lbrack {a_{0},a_{1},\ldots\mspace{14mu},a_{n}} \right\rbrack = {a_{0} + \frac{1}{a_{1} + \frac{1}{a_{2} + {\ldots\mspace{14mu}\frac{1}{a_{n}}}}}}} & {{Eq}.\mspace{11mu} 15} \\ {and} & \; \\ {\begin{matrix} {{p_{0} = a_{0}},} \\ {{p_{1} = {{a_{1}a_{0}} + 1}},} \end{matrix}\begin{matrix} {{q_{0} = 1},} \\ {q_{1} = a_{1}} \end{matrix}\begin{matrix} {p_{n} = {{a_{n}p_{n - 1}} + p_{n - 2}}} \\ {q_{n} = {{a_{n}q_{n - 1}} + {q_{n - 2}.}}} \end{matrix}} & (16) \\ {{Thus},} & \; \\ {a_{n} = {\frac{p_{n}}{q_{n}} = \left\{ \begin{matrix} {a,{n = 0}} \\ {{a_{0} + \frac{1}{a_{1}}},{n = 1}} \\ {\frac{{a_{n}p_{n - 1}} + p_{n - 2}}{{a_{n}q_{n - 1}} + q_{n - 2}},{n \geq 2}} \end{matrix} \right.}} & (17) \end{matrix}$ Every a_(n) is a partial quotient of the continued fraction, which has a corresponding complete quotient a′_(n)=a_(n)+ξ_(n) with 0≤ξ_(n)<1. As a result, x can be represented as

$x = {\frac{{a_{n + 1}^{\prime}p_{n}} + p_{n - 1}}{{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}}.}$ Therefore,

$x - \frac{p_{n}}{q_{n}}$ is:

$\begin{matrix} \begin{matrix} {{x - \frac{p_{n}}{q_{n}}} = {\frac{{a_{n + 1}^{\prime}p_{n}} + p_{n - 1}}{{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}} - \frac{p_{n}}{q_{n}}}} \\ {= {\frac{{a_{n + 1}^{\prime}p_{n}q_{n}} + {p_{n - 1}q_{n}}}{q_{n}\left( {{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}} \right)} - \frac{{a_{n + 1}^{\prime}p_{n}q_{n}} + {p_{n - 1}q_{n - 1}}}{q_{n}\left( {{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}} \right)}}} \\ {= \frac{{p_{n - 1}q_{n}} - {p_{n}q_{n - 1}}}{q_{n}\left( {{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}} \right)}} \end{matrix} & {{Eq}.18} \end{matrix}$ Observe that p_(n−1)q_(n)−p_(n)q_(n−1)=(−1)^(n), which can be verified with n=2. Therefore,

$\begin{matrix} {{x - \frac{p_{n}}{q_{n}}} = {\frac{{p_{n - 1}q_{n}} - {p_{n}q_{n - 1}}}{q_{n}\left( {{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}} \right)} = \frac{\left( {- 1} \right)^{n}}{q_{n}\left( {{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}} \right)}}} & {{Eq}.19} \end{matrix}$ Let q′₁=a′₁ and q′_(n)=a′_(n)q_(n−1)+q_(n−2). Then,

$\begin{matrix} {{x - \frac{p_{n}}{q_{n}}} = {\frac{\left( {- 1} \right)^{n}}{q_{n}\left( {{a_{n + 1}^{\prime}q_{n}} + q_{n - 1}} \right)} = \frac{\left( {- 1} \right)^{n}}{q_{n}q_{n + 1}^{\prime}}}} & {{Eq}.20} \end{matrix}$ Notice that q_(n) increases steadily as n increases, so q_(n)>q_(n−1). Similarly, q′_(n+1)≥q_(n+1) because q′_(n)=a′_(n)q_(n−1)+q_(n−2) and q_(n)=a_(n)q_(n−1)+q_(n−2), where the complete quotient a′_(n) is always greater than the partial quotient a_(n). Then, the following inequalities can be defined.

$\begin{matrix} {q_{n + 1}^{\prime} \geq q_{n + 1} > {q_{n}{and}\frac{1}{q_{n + 1}^{\prime}}} \leq \frac{1}{q_{n + 1}} < {\frac{1}{q_{n}}.}} & {{Eq}.21} \end{matrix}$ Finally,

$\begin{matrix} {{❘{x - \frac{p_{n}}{q_{n}}}❘} = {\frac{\left( {- 1} \right)^{n}}{q_{n}q_{n + 1}^{\prime}} \leq \frac{1}{q_{n}q_{n + 1}} < {\frac{1}{q_{n}^{2}}.}}} & {{Eq}.22} \end{matrix}$

Example 3. Let a_(N)=[1, 2, 3, 1], which gives the following values for p_(n) and q_(n).

$\begin{matrix} {{p_{0} = {a_{0} = 1}}{q_{0} = 1}{p_{1} = {{{a_{1}a_{0}} + 1} = 3}}{q_{1} = {a_{1} = 2}}{p_{2} = {{{a_{2}p_{1}} + p_{0}} = 10}}{q_{2} = {{{a_{2}q_{1}} + q_{0}} = 7}}{p_{3} = {{{a_{3}p_{2}} + p_{1}} = 13}}{q_{3} = {{{a_{3}q_{2}} + q_{1}} = 9}}{and}} & {{Eq}.23} \end{matrix}$ $\begin{matrix} {\left\lbrack {1,2,3,1} \right\rbrack = {1 + \frac{1}{2 + \frac{1}{3 + \frac{1}{1}}}}} & {{Eq}.24} \end{matrix}$ which gives,

$\begin{matrix} {{{a_{0}^{\prime} = {1 + \frac{1}{2}}},{a_{1}^{\prime} = {2 + \frac{1}{3}}},{\xi_{0} = \frac{1}{2}}}{{a_{2}^{\prime} = {3 + \frac{1}{1}}},{\xi_{1} = \frac{1}{3}}}{{a_{3}^{\prime} = {\frac{1}{\xi_{2}} = 1}},{\xi_{2} = \frac{1}{1}}}} & {{Eq}.25} \end{matrix}$ The distance between x and

$\frac{p_{2}}{q_{2}}$ is:

$\begin{matrix} \begin{matrix} {{❘{x - \frac{p_{2}}{q_{2}}}❘} = {❘{\frac{{a_{3}^{\prime}p_{2}} + p_{1}}{{a_{3}^{\prime}q_{2}} + q_{1}} - \frac{p_{2}}{q_{2}}}❘}} \\ {= {❘{\frac{13}{9} - \frac{10}{7}}❘}} \\ {= \frac{1}{63}} \end{matrix} & {{Eq}.26} \end{matrix}$

The inequality in Lemma 1 can be verified, where

$\frac{1}{q_{2}q_{3}} = {{\frac{1}{63}{and}\frac{1}{q_{2}^{2}}} = {\frac{1}{49}.}}$

$\begin{matrix} {{❘{x - \frac{p_{2}}{q_{2}}}❘} = {\frac{1}{63} \leq \frac{1}{q_{2}q_{3}} < \frac{1}{q_{2}^{2}}}} & {{Eq}.26} \end{matrix}$

Theorem 4. If given α=a/b, we compute h=ab⁻¹ mod p, where 0≤|a|≤N, 0≤|b|≤p/(N+1) for N=|√{square root over (p/2)}|, then, since the EEA applied to p and h computes all the convergents of h/p, α is set to be the i-th convergent a_(i)/y_(i) of h/p. We write this as a=H⁻¹(p, h).

Proof. We can rearrange h=ab⁻¹ mod p as a modular equation: hb−a≡0 mod p  Eq. 28 The aim is to show that −k/b is a convergent of h/p by rearranging

${{❘{h - \frac{a}{b}}❘}{as}\frac{a}{bp}} = {\frac{h}{p} - {\frac{k}{b} \cdot {hb}} - a}$ is congruent to 0 and therefore a multiple k of p. Thus, hb−a=kp and a=hb−kp  Eq. 29 Then, dividing both sides by bp gives:

$\begin{matrix} {\frac{a}{bp} = {\frac{h}{p} - \frac{k}{b}}} & {{Eq}.30} \end{matrix}$ By applying Lemma 1 we can prove that −k/b is a convergent of h/p by satisfying

$\begin{matrix} {{❘{\frac{h}{p^{r}} - \frac{k}{b}}❘} < \frac{1}{b^{2}}} & {{Eq}.31} \end{matrix}$ and it can be computed by the algorithm that computes all the convergents, the EEA. Then the value a/b can be obtained by EEA as a_(i)/y_(i) for the i such that |y_(i)|≤N.

Definition 5. Let

_(h/p) denote the set of all convergents of h/p such that:

$\begin{matrix} {{\mathbb{C}}_{h/p} = \left\{ {{{a/b}❘{{❘{\frac{h}{p} - \frac{k}{b}}❘} < \frac{1}{b^{2}}}},{k = {\left( {{bh} - a} \right)/p}}} \right\}} & {{Eq}.32} \end{matrix}$

Lemma 2. If r=1, given α=a/b and a prime number p, where a, b, p are pairwise coprime, the Hensel code h of α computed as h=ab⁻¹ mod p, then h is the zeroth term of the finite expansion that computes α.

Proof. Given α=a/b, we have ba0=a mod p, thus, the solution for a₀=ab⁻¹ mod p=h.

We compute Theorem 4 via a modified version of the EEA (MEEA), which is given in Algorithm 1.

Algorithm 1: (MEEA) α = H⁻¹ (p, h) Input: p, h; Output: α such that h = H (p, α) a₀ = p, a₁ = h; y₀ =0, y₁ =1; i = 1; N = └√{square root over (p/2)}┘ while a_(i) > N do q = └a_(i−1)/a_(i)┘; a_(i+1) = a_(i−1) − q · a_(i); y_(i+1) = y_(i−1) + q · y_(i); i = i + 1; end α = ((−1)^(i+1) · a_(i))/y_(i); Result: α

Example 4. Let h=97, p=241. We calculate α=H⁻¹(p, h) as follows: a ₀ =p=241, a ₁ =h=97, y ₀=0, y ₁=1, i=1.  Eq. 33 In the second iteration, we have: q=└a ₀ /a ₁┘=2, a ₂ =a ₁ −q·a ₀=47, y ₂ =y ₁ −q·y ₀=2, i=2  Eq. 34 and therefore: q=└a ₁ /a ₂┘=2, a ₃ =a ₂ −q·a ₁=3,y ₃ =y ₂ −q·y ₁=5, i=3,  Eq. 35 and therefore: c=(−1)^(i+1) ·a _(i) , d=y _(i).  Eq. 36 The result is then given by α=c/d=3/5

Remark 2. Algorithm 1 computes all the convergents a_(i)/y_(i) of h/p until finding the first convergent that satisfies

${{❘a_{i}❘} \leq N},{{❘y_{i}❘} \leq \left\lfloor \frac{p}{N + 1} \right\rfloor},{N = {\left\lfloor \sqrt{p/2} \right\rfloor.}}$

Theorem 5. Algorithm 1 runs in O (log N).

Proof. Algorithm 1 is a modified EEA and this modification is solely on the setup of the inputs and the presentation of the results. Its complexity its truly defined by the while loop that computes all the convergents of h/p which is bounded by N and the complexity of the bounded computation of all convergents by the EEA is O (log N).

2.3 Order-N Farey Fractions

There are some additional properties of the set of order-N Farey fractions that are worth discussing. In this section we provide some insights on the mapping between those fractions and their corresponding Hensel codes which will be relevant in understanding why this relationship can be useful for cryptography.

Recall that a prime number p encodes p order-N Farey fractions, each one with their unique corresponding integer from the set

_(p)={0, . . . , p−1}. But what does N represent in terms of the mapping between order-N Farey fractions and their Hensel codes? We present some observations that we consider important in understanding this connection. We introduce Example 5 to illustrate that the order-N Farey fractions have 2N+1 integers and p−(2N+1) non-integer fractions. This metric is used in Theorem 8. Example 5 aims to assist the understanding that N determines the number of non-zero integer fractions allowed in the set, and by allowing zero, positive and negative integers, we have 2N+1.

Example 5. If p₁=17, then N=└√{square root over (17/2)}┘=2, and p₁ encodes 17 order-N fractions with 17 integer Hensel codes, as we can see below:

$\begin{matrix} \begin{matrix} {0/1} & {\left. \rightarrow 0 \right.,{1/1}} & {\left. \rightarrow 1 \right.,{2/1}} & {\left. \rightarrow 2 \right.,{{- 2}/5}} & {\left. \rightarrow 3 \right.,} \\ {{- 1}/4} & {\left. \rightarrow 4 \right.,{{- 2}/3}} & {\left. \rightarrow 5 \right.,{1/3}} & {\left. \rightarrow 6 \right.,{1/5}} & {\left. \rightarrow 7 \right.,} \\ {{- 1}/2} & {\left. \rightarrow 8 \right.,{1/2}} & {\left. \rightarrow 9 \right.,{{- 1}/5}} & {\left. \rightarrow 10 \right.,{{- 1}/3}} & {\left. \rightarrow 11 \right.,} \\ {2/3} & {\left. \rightarrow 12 \right.,{1/4}} & {\left. \rightarrow 13 \right.,{2/5}} & {\left. \rightarrow 14 \right.,{{- 2}/1}} & {\left. \rightarrow 15 \right.,} \\ {{- 1}/1} & \left. \rightarrow 16. \right. & & &  \end{matrix} & {{Eq}.37} \end{matrix}$

We observe that in the set of order-N Farey fractions in (37), there are 2N+1=5 integers and p₁−(2N+1)=17−5=12 non-integer fractions. If p₂=13, then N=└√{square root over (13/2)}┘=2, and p₂ encodes 13 order-N fractions with 13 integers, as we can see below:

$\begin{matrix} \begin{matrix} {0/1} & {\left. \rightarrow 0 \right.,{1/1}} & {\left. \rightarrow 1 \right.,{2/1}} & {\left. \rightarrow 2 \right.,{{- 1}/4}} & {\left. \rightarrow 3 \right.,} \\ {{- 1}/3} & {\left. \rightarrow 4 \right.,{2/3}} & {\left. \rightarrow 5 \right.,{{- 1}/2}} & {\left. \rightarrow 6 \right.,{1/2}} & {\left. \rightarrow 7 \right.,} \\ {{- 2}/3} & {\left. \rightarrow 8 \right.,{1/3}} & {\left. \rightarrow 9 \right.,{1/4}} & {\left. \rightarrow 10 \right.,{{- 2}/1}} & {\left. \rightarrow 11 \right.,} \\ {{- 1}/1} & \left. \rightarrow 12. \right. & & &  \end{matrix} & {{Eq}.38} \end{matrix}$

Similarly, we observe that in the set of order-N Farey fractions in (38), there are 2N+1=5 integers and p₂−(2N+1) non-integer fractions.

Notice in Example 5 that p₁ and p₂ share the same N, which indicates that their corresponding set of order-N Farey fractions have the same number of integers, with, however, different number of non-integer Farey fractions. Notice also that in Algorithm 1, we only compute the convergents while the numerator is greater than N for a given prime p and Hensel code h.

Lemma 3. Given an odd prime p, N=└√{square root over (p/2)}┘, and the Hensel codes h_(α), h_(β)∈

_(p) where h_(α)=H(p, α), h_(β)=H(p, β), and α and β are integers, for all h_(α)≤N, it holds that H⁻¹(p, h_(α))=α=h_(α) and for all h_(β)>N it holds that H⁻¹(p, h_(β))=β≠h_(β).

Proof. The modified EEA in Algorithm 1 is committed to compute all the convergents of a Hensel code h with respect to a prime p while a_(i)>N for N=└√{square root over (p/2)}┘. Any Hensel code less than or equal to N will decode to a rational α=h since the setup of the algorithm defines a₀=p and a₁=h. Thus, it is clear that if h is not greater than N, then the iterations that computes the convergents are never calculated and the result is guaranteed to be an integer since we defined y₁=1. With i=1, then it is guaranteed that

$\frac{\left( {- 1} \right)^{1 + 1} \cdot a_{1}}{y_{1}} = {h.}$ Conversely, if a_(i) is indeed greater than N, this means that a convergent will be computed and a non-integer fraction will be output by the algorithm. Since Lemma 3 specifies that input order-N Farey fractions are integers, it is clear that whenever a_(i)>N, the resulting fraction α is not equal to its corresponding Hensel code h.

Corollary 1. In all sets of order-N Farey fractions, there are N+1 non-negative integers which the corresponding Hensel codes are equal to the original fractions.

Corollary 2. A Hensel code h decoded with two distinct primes p₁ and p₂ will only result in the same order-N Farey fraction α if α∈

, a≤N and N=└√{square root over (p₁/2)}┘=└√{square root over (p₂/2)}┘.

Theorem 6. For all Hensel code h such that p−N≤h<p where N=└√{square root over (p₂/2)}┘ it holds that the order-N Farey fraction α associated with h is a negative integer in {−N, . . . , −1}. We write H⁻¹(p, h)=−x, x∈{1, . . . , N}.

Proof. The modified EEA in Algorithm 1 defines a₀=p and a₁=h. If N≤h≥p−N, then a₁>N. In the first iteration, q is defined as q=└a₀/a₁┘, with for h≥p−N<p will be always equal to 1. Then, we compute a₂ as a₂=a₀−qa₁, which for h≥p−N<p it holds that a₂≤N. Thus, there are no more iterations. Since q=1, y₂ is computed as y₂=y₀+q·y₁. Recall that in Algorithm 1, we start by defining y₀=0 and y₁=1. Thus, it holds that y₂=1. Since by the end of the first iteration i=2, then ((−1)²⁺¹·a₂)/y₂=−x, x∈{1, . . . , N}.

Theorem 7. For all prime p, there are p Hensel codes to encode p order-N (irreducible) Farey fractions where N=└√{square root over (p/2)}┘, which is composed by 2N+1 integers (fractions with one as the denominator) and p−(2N+1) non-integer fractions.

Proof. For all prime p and N=└√{square root over (p/2)}┘, Corollary 1 states that there are N+1 positive integer order-N Farey fractions in

_(N) and Theorem 6 states that there are N negative integer Farey fractions in

_(N), which gives a total of 2N+1 integers order-N Farey fractions in

_(N). The non-integer Farey fractions are then given by p−(2N+1).

We are now ready to formally state a new definition and notation for the set of order-N Farey fractions with respect to a prime p.

Theorem 8. For all prime p and a/b∈

_(p), the set of order-N Farey fractions

_(p), where N is given by N=└√{square root over (p/2)}┘.

$\begin{matrix} {{\mathbb{F}}_{p} = \left\{ \begin{matrix} {{\gcd\left( {a,b} \right)} = {{\gcd\left( {a,p} \right)} = {{\gcd\left( {b,p} \right)} = 1}}} \\ {{and}\frac{a}{b}{is}{the}{first}{convergent}{in}{\mathbb{C}}_{h/p}{such}{that}} \\ {{0 \leq {❘a❘} \leq N},{0 < {❘b❘} \leq \left\lfloor {p/\left( {N + 1} \right)} \right\rfloor}} \end{matrix} \right.} & {{Eq}.39} \end{matrix}$

Proof. Lemma 3 states that all Hensel codes h≤N will decode to an order-N Farey fraction α=h and Theorem 6 states that all Hensel codes N≤h≥p−N<p will decode to an order-N Farey fraction α that is a negative integer in the set {−N, . . . , −1}. Thus, the first N+1 elements of

_(p) are non-negative integers and the last N elements of

_(p) are negative integers. Thus, it is clear that the last non-integer element of

_(p) is the one which the corresponding Hensel code is h=p−(N+1). Given this Hensel code h, the setup of Algorithm 1 sets as initial values a₀=p, a₁=p−(N+1) and y₀=0, y₁=1. Then, in the first iteration, for all prime p that generates sets

_(p) with at least one non-integer fraction (e.g., p≥5), the result of q=a₀/a₁=└p/p−(N+1)┘ will always be 1. Then, a ₂ =p−(p−(N+1)=N+1 y ₂=0+1·1=1  Eq. 40 In the next iteration, we compute q, a₃ and y₃ as: q=└a ₁ /a ₂┘=└(p−(N+1))/(N+1)┘ a ₃ =a ₁ −q·a ₂=(P−(N+1)−└(p−(N+1))/(N+1)┘·(N+1) y ₃ =y ₁ +q·y ₂=1+└(p−(N+1))/(N+1)┘·1=└p/(N+1)┘  Eq. 41

Since a₃ is not greater than N, the algorithm stops and the denominator of the solution is given by y₃.

2.4 Ring Isomorphism of Order-N Farey Fractions

The order-N Farey fractions

_(p), in which the elements are scoped as stated in Theorem 8, is a set equipped with two binary operations, addition and multiplication, where

_(p) is associative and commutative under addition, and have an additive inverse and additive identity, and is associative and distributive under multiplication, and has a multiplicative identity. All non-zero elements of

_(p) has a multiplicative inverse. Addition and multiplication in

_(p) are defined as follows: α+β∈

_(p) =H ⁻¹(p,H(p,α+β))  Eq. 42 αβ∈

_(p) =H ⁻¹(p,H(p,αβ))

Therefore,

_(p) is a commutative ring. We want to show that

_(p) is isomorphic with Zp. In Theorem 3 we showed that the function H uniquely and correctly maps elements of

_(p) to elements of

_(p) and in Theorem 4 we showed that the function H⁻¹ uniquely and correctly maps elements of

_(p) to elements of

_(p). Now we show the ring isomorphism between

_(p) and

_(p) by further examining addition and multiplication.

Lemma 4. For all α, β∈

_(p) the following holds: H(p,α+β)=H(p,α)+H(p,β) α+β=H ⁻¹(p,H(p,α+β))  Eq. 43

Proof. Given α=a/b, β=c/d∈

_(p), recall that each Hensel code h=ab⁻¹ mod p can be rewritten as a diophantine equation so we can write the Hensel code of α, β, respectively, as: h _(α)=(a−k _(α) p)/b h _(β)=(c−k _(β) p)/d  Eq. 44 where k_(α), k_(β) are given by: k _(α)=(a−bh)/p k _(β)=(c−dh)/p  Eq. 45

Then, we can write the following:

$\begin{matrix} {{{H\left( {p,\alpha} \right)} + {H\left( {p,\beta} \right)}} = {{\frac{a}{b} + \frac{c}{d} - \frac{{pk}_{\alpha}}{b} - \frac{{pk}_{\beta}}{d}} = h_{\alpha + \beta}}} & {{Eq}.46} \end{matrix}$ We compute k_(α+β) as:

$\begin{matrix} {k_{\alpha + \beta} = {{ad} + {bc} - {{bd}\frac{\left( {\frac{\left( {a - {k_{\alpha}p}} \right)}{p} + \frac{\left( {a - {k_{\beta}p}} \right)}{d}} \right)}{p}}}} & {{Eq}.47} \end{matrix}$ which allows us to obtain the numerator and denominator of a/b+c/d which is given by computing H⁻¹(p, α+β) and we verify that:

$\begin{matrix} {{{{ad} + {bc}} = {{bdh}_{\alpha + \beta} + {k_{\alpha + \beta}p}}}{{bd} = \frac{\left( {{ad} + {bc}} \right) - {k_{\alpha + \beta}p}}{h_{\alpha + \beta}}}{{Thus},}} & {{Eq}.48} \end{matrix}$ $\begin{matrix} {{H^{- 1}\left( {p,h_{\alpha + \beta}} \right)} = {{\left( {{ad} + {bc}} \right)/{bd}} = {\alpha + \beta}}} & {{Eq}.49} \end{matrix}$

Lemma 5. For all α, β∈

_(p) the following holds: H(p,αβ)=H(p,α)H(p,β) αβ=H ⁻¹(p,H(p,αβ))  Eq. 50

Proof. For α=a/b, β=c/d∈

_(p), once again we have: H(p,α)=h _(α)=(a−k _(α) p)/b H(p,β)=h _(β)=(c−k _(β) p)/d  Eq. 51 where k _(α)=(a−bh)/p k _(β)=(c−dh)/p  Eq. 52 Then we can write the following:

$\begin{matrix} {{{H\left( {p,\alpha} \right)}{H\left( {p,\beta} \right)}} = {\frac{\left( {a - {k_{\alpha}p}} \right)\left( {c - {k_{\beta}p}} \right)}{bd} = h_{\alpha\beta}}} & {{Eq}.53} \end{matrix}$

We compute k_(αβ) as follows:

$\begin{matrix} {k_{\alpha\beta} = \frac{\left( {{ac} - {\left( {a - {k_{\alpha}p}} \right)\left( {c - {k_{\beta}p}} \right)}} \right.}{p}} & {{Eq}.54} \end{matrix}$ which allows us to obtain the numerator and denominator of a/b·c/d which is given by computing H⁻¹(p, αβ) and we verify that:

$\begin{matrix} {{{ac} = {{bdh}_{\alpha\beta} + {k_{\alpha\beta}p}}}{{bd} = \frac{{ac} - {k_{\alpha\beta}p}}{h_{\alpha\beta}}}{{Thus},}} & {{Eq}.55} \end{matrix}$ $\begin{matrix} {{H^{- 1}\left( {p,h_{\alpha\beta}} \right)} = {{{ac}/{cd}} = {\alpha\beta}}} & {{Eq}.56} \end{matrix}$

We define the modulo p operation on elements of

as follows: α mod p=H ⁻¹(p,H(p,α)),α∈

_(N).  Eq. 57

Example 6. Let p=83, and a/b=c/d=5/6∈

_(N). We show that the product: 5/6·5/6=25/36,  Eq. 58 corresponds to:

$\begin{matrix} {{H\left( {p,{\frac{5}{6} \cdot \frac{5}{6}}} \right)} = {{H\left( {p,\frac{25}{36}} \right)} = {{25 \cdot (36)^{- 1}} = {{25 \cdot 30} = {3{mod}83.}}}}} & {{Eq}.59} \end{matrix}$ It is easy to verify that since

${{H\left( {p,\frac{5}{6}} \right)} = 70},$ then: 70·70=3 mod 83.  Eq. 60

Example 7. Let p=83, and a/b=c/d=6/11∈

_(N). We show that the sum: 6/11+6/11=12/11,  Eq. 61 corresponds to:

$\begin{matrix} {{H\left( {p,{\frac{6}{11} + \frac{6}{11}}} \right)} = {{H\left( {p,\frac{12}{11}} \right)} = {{12 \cdot (11)^{- 1}} = {{12 \cdot 68} = {69\mspace{14mu}{mod}\mspace{14mu} 83.}}}}} & {{Eq}.\mspace{14mu} 62} \end{matrix}$ It is easy to verify that since

${{H\left( {p,\frac{6}{11}} \right)} = 76},$ then: 76+76=69 mod 83.  Eq. 63

Example 8. What if the computations on elements in

_(p) produce a very large result which is way far from

_(p)? We show that the result, no matter what it is, is congruent modulo p. Let p=83, and a/b=5/9. Then, we show that the following holds:

$\begin{matrix} {{H\left( {83,{5\text{/}{9 \cdot 5}\text{/}{9 \cdot 5}\text{/}9}} \right)} = {{H\left( {p,\frac{5}{9}} \right)} \cdot {H\left( {p,\frac{5}{9}} \right)} \cdot {H\left( {p,\frac{5}{9}} \right)}}} & {{Eq}.\mspace{14mu} 64} \end{matrix}$ where the computation with Hensel codes is reduced modulo 83. We see that: H(83,5/9·5/9·5/9)=H(83,5³/9³)=53  Eq. 65 and since H(83,5/9)=19  Eq. 66 then, 19³=53 mod 83.  Eq. 67

Theorem 9. For any given prime p, there is a ring isomorphism between

_(p) and

_(p).

Proof. According to Theorems 3 and 4, the function H correctly and uniquely maps each member of

_(p) to a member of

_(p) as well as the function H⁻¹ correctly and uniquely maps each member of

_(p) to a member of

_(p). Lemmas 4 and 5 show that H and H⁻¹ preserve this correspondence over addition and multiplication. Thus, there is a one-to-one and onto correspondence between

_(N) and

_(p).

2.5 g-adic Numbers

Definition 6. Let g be a positive integer which is written as the product of k distinct primes such that g=Π_(i=1) ^(k)p_(i). A g-adic number has a unique expansion of the form x=a₀+a₁g+a₂g²+ . . . , where a₀≠0 and 0≤a_(i)≤g. If we let a₀+a₁g+ . . . +a_(i)g^(i), then the expansion of a rational number a/b can be computed in terms of g as long as a, b and g are pairwise coprime.

Definition 7. g-adic number forward map Given k distinct prime numbers p₁, . . . , p_(k), for k≥1, and a rational number a/b such that:

$\begin{matrix} {{\mathbb{F}}_{g} = \left\{ {\begin{matrix} {{\gcd\left( {a,b} \right)} = {{\gcd\left( {a,g} \right)} = {{\gcd\left( {b,g} \right)} = 1}}} \\ {{{a\text{/}b} \in {\mathbb{Q}}_{g}}❘{{and}\mspace{14mu} a\text{/}b\mspace{14mu}{is}\mspace{14mu}{the}\mspace{14mu}{first}\mspace{14mu}{convergent}\mspace{14mu}{in}\mspace{14mu}{\mathbb{C}}_{h\text{/}g}\mspace{14mu}{such}\mspace{14mu}{that}}} \\ {{0 \leq {a} \leq N},{0 < {b} \leq \left\lfloor {g\text{/}\left( {N + 1} \right)} \right\rfloor}} \end{matrix}\mspace{76mu}{where}} \right.} & {{Eq}.\mspace{14mu} 68} \\ {\mspace{76mu}{{N = \left\lfloor \sqrt{g\text{/}2} \right\rfloor},{g = {\prod\limits_{i = 1}^{k}\; p_{i}}},}} & {{Eq}.\mspace{14mu} 69} \end{matrix}$ the k-digit Hensel code forward mapping is calculated as follows:

$\begin{matrix} \begin{matrix} {\left( {h_{1},\ldots\;,h_{k}} \right) = {H_{g}\left( {\left( {p_{1},\ldots\;,p_{k}} \right),{a\text{/}b}} \right)}} \\ {= \left( {{H\left( {p_{1},{a\text{/}b}} \right)},\ldots\;,{H\left( {p_{k},{a\text{/}b}} \right)}} \right)} \end{matrix} & {{Eq}.\mspace{14mu} 70} \end{matrix}$ We write (h₁, . . . , h_(k))=H_(g)((p₁, . . . , p_(k)), a/b).

Example 9. Given p₁=241, p₂=251, p₃=281, a/b=3/5, the multiple direct Hensel code mapping is calculated as follows:

$\begin{matrix} \begin{matrix} {\left( {h_{1},\ldots\;,h_{k}} \right) = {H_{g}\left( {\left( {p_{1},\ldots\;,p_{k}} \right),{a\text{/}b}} \right)}} \\ {= {H_{g}\left( {\left( {241,251,281} \right),{3/5}} \right)}} \\ {= \left( {97,101,113} \right)} \end{matrix} & {{Eq}.\mspace{14mu} 71} \end{matrix}$

In order to define the g-adic number inverse map we introduce Lemma 6.

Lemma 6. Given an order-N Farey fraction α, k primes p₁, . . . , p_(k) and g=Π_(i=1) ^(k)p_(i), the k-digit Hensel code (h₁, . . . , h_(k))=H_(g)((p₁, . . . , p_(k)), a) and the single digit Hensel code h=H(g, a) are equivalent since they represent the same quantity α.

Proof. The single most relevant property in any prime p for being used to compute Hensel codes for order-N Farey fractions α is that p does not share any common divisor greater than 1 with any number less than p and therefore a modular multiplicative inverse of any number less than p and p is guaranteed to exist. Given k primes p₁, . . . , p_(k), the k-digit Hensel code of a=a/b is computed as (H (p₁, α), . . . , H (p_(k), α)). Since the Hensel code direct mapping requires a, b and each p_(i) to be pairwise coprime and each Hensel code digit h_(i) is less than each corresponding p_(i), it is guaranteed that gcd(a, g)=gcd(b, g)=1 for g=Π_(i=1) ^(k)p_(i). If we compute (h₁, . . . , h_(k))=H_(g)((p₁, . . . , p_(k)), α), we verify that:

$\begin{matrix} {{\sum\limits_{i = 1}^{k}\;{\frac{g}{p_{i}}\left( {\left( \frac{g}{p_{i}} \right)^{- 1}{mod}\mspace{14mu} p_{i}} \right)h_{i}\mspace{14mu}{mod}\mspace{14mu} g}} = {{ab}^{- 1}\mspace{14mu}{mod}\mspace{14mu} g}} & {{Eq}.\mspace{14mu} 72} \end{matrix}$ and thus H_(g)((p₁, . . . p_(k)), α)≡H(g, α).

Example 10. Let p_(i)=241, p₂=251, p₃=257, g=241·251·257=15546187 and a=3/5. We compute the 3-digit Hensel code for a as follows: (97,101,52)=H ₉((241,251,257),3/5)  Eq. 73 By computing the left-hand side of Eq. 72 we have: (64507·119·97+61937·46·101+60491·83·52)=1293442759  Eq. 74 and 1293442759 mod g=1293442759 mod 15546187=3109238  Eq. 75 By computing the right-hand side of Eq. 72 we have: 3·5⁻¹ mod 15546187=3·6218475 mod 15546187=3109238  Eq. 76 which is compliant with Eq. 72.

Definition 8. g-adic number inverse map Given k distinct odd prime numbers p₁, . . . , p_(k), and a k-digit Hensel code (h₁, . . . , h_(k)), the corresponding rational number a/b is calculated as follows:

$\begin{matrix} {z = {\sum\limits_{i = 1}^{k}\;{\frac{g}{p_{i}}\left( {\left( \frac{g}{p_{i}} \right)^{- 1}{mod}\mspace{14mu} p_{i}} \right)h_{i}\mspace{14mu}{mod}\mspace{14mu} g}}} & {{Eq}.\mspace{14mu} 77} \end{matrix}$ where z is computed via the CRT, g=Π_(i=1) ^(k)p_(i), and the result a/b is computed as

$\frac{a}{b} = {{H^{- 1}\left( {g,z} \right)}.}$ We write a/b=H_(g) ⁻¹((p_(i), . . . , p_(k)), (h₁, . . . h_(k))).

Example 11. Given p₁=241, p₂=251, p₃=281 and the Hensel codes h₁=97, h₂=101, h₃=113, we calculate the corresponding rational number a/b as follows:

$\begin{matrix} {\begin{matrix} {z = {\sum\limits_{i = 1}^{2}\;{\frac{g}{p_{i}}\left( {\left( \frac{g}{p_{i}} \right)^{- 1}{mod}\mspace{14mu} p_{i}} \right)h_{i}\mspace{14mu}{mod}\mspace{14mu} g}}} \\ {= 6799189} \end{matrix}{and}} & {{Eq}.\mspace{14mu} 78} \\ \begin{matrix} {{a\text{/}b} = {H^{- 1}\left( {g,z} \right)}} \\ {= {H^{- 1}\left( {16997971,6799189} \right)}} \\ {= {3\text{/}5}} \end{matrix} & {{Eq}.\mspace{14mu} 79} \end{matrix}$

Theorem 10. Let (p₁, . . . , p_(k)) be k distinct primes, and N=└√{square root over (g/2)}┘. A k-digit Hensel code encoded in terms of (p₁, . . . , p_(k)) is equivalent to a single digit Hensel code encoded in terms of g.

Proof. Given k primes (p_(i), . . . , p_(k)), N=└√{square root over (b/2)}┘, g=Π_(i=1) ^(k)p_(i), a rational number a/b where a, b, g are pairwise coprimes and a k-digit Hensel code (h₁, . . . , h_(k))=H_(g)((p₁, . . . , p_(k)), a/b), it holds that:

$\begin{matrix} {\sum\limits_{i = 1}^{k}\;{\frac{g}{p_{i}}\left( {\left( \frac{g}{p_{i}} \right)^{- 1}{mod}\mspace{14mu} p_{1}} \right)h_{i}\mspace{14mu}{mod}\mspace{14mu}{g.}}} & {{Eq}.\mspace{14mu} 80} \end{matrix}$

It is easy to see that (80) holds if we have a single prime and g=p. Then mod

${\frac{g}{p_{i}}\left( {\left( \frac{g}{p_{i}} \right)^{- 1}{mod}\mspace{14mu} p_{i}} \right)} = 1$ and we gave h mod g left, since we have a single code for a single prime. Thus, ab⁻¹ mod g. Another way to see this equivalence is by inspecting the g-adic number inverse map in Definition 8. The first of decoding a k-digit Hensel code is to compute z in Eq. 77. Then, z is decoded as a single Hensel code in terms of g and it is clear that:

$\begin{matrix} {{H\left( {g,{a\text{/}b}} \right)} = {\sum\limits_{i = 1}^{k}\;{\frac{g}{p_{i}}\left( {\left( \frac{g}{p_{i}} \right)^{- 1}{mod}\mspace{14mu} p_{i}} \right)h_{i}\mspace{14mu}{mod}\mspace{14mu}{g.}}}} & {{Eq}.\mspace{14mu} 81} \end{matrix}$

Example 12. Let k=4, (p₁, p₂, p₃, p₄)=(17, 23, 37, 41), g=Π_(i=1) ^(k)p_(i)=593147 and a/b=25/11. The 4-digit Hensel code for 25/11 is given by: H _(g)((17,23,37,41),25/11)=(10,19,9,6).  Eq. 82 In order to decode (10, 19, 9, 6) back to a/b, according to Definition 8, the first step is to compute z via CRT: z=34891·5·10+25789·4·19+16031·26·9+14467·34·6=323537,  Eq. 83 and we check that:

$\begin{matrix} {{H\left( {g,\frac{a}{b}} \right)} = {{H\left( {593147,\frac{25}{11}} \right)} = 323537.}} & {{Eq}.\mspace{14mu} 84} \end{matrix}$

Theorem 11. A rational number a/b encoded with k distinct primes (p₁, . . . , p_(k)) must result in k distinct Hensel digits if a/b is not a positive integer.

Proof. Since a, b and p_(i), for i=1 . . . k are all pairwise coprime, the only way to have non-distinct Hensel digits in (ab⁻¹ mod p_(i), . . . , ab⁻¹ mod p_(k)) is if 0≤a≤p_(i) (for all i) and b=1, which indicates that a/b is a positive integer. If a≥0 and b>0, b≠1, then the modular multiplicative inverse of b with respect to p_(i) is unique, which will result in k distinct Hensel digits. If a<0 and b=1, which indicates that a/b is a negative integer, the modular additive inverse of a with respect to p_(i) is also unique, resulting in k distinct Hensel digits.

3. Encrypting Rational Numbers

The theory of p-adic numbers is sometimes referred as a theory of representation, mostly for its ability of consistently replacing the arithmetic over rational numbers by the arithmetic over the integers. In some applications, critical data are often represented as fractions, as it is the case of machine learning, where some data need to be normalized and then taken the standard deviation, production values within, say, 0 and 1. In this section we want to demonstrate that some well-known cryptosystems can be slightly modified to include rational numbers in the set of its inputs without adding extra variables or compromising existing homomorphic properties, as it is the case of RSA.

3.1 RSA with Rational Numbers

The RSA cryptosystem can be summarized as follows: given a public key e and two secret prime numbers p and q, a public key n is computed such that n=pq and the private keys ϕ(n) and d are computed such that ϕ(n)=(p−1)(q−1) and d=e⁻¹ mod ϕ(n), i.e., ed=1 mod ϕ(n). Given a message m, a ciphertext c is computed such that c=m^(e) mod n. The message m can be retrieved from c such that m=c^(d) mod n. This is known as the “naive” RSA signatures, which is sufficient for this particular discussion, since we are addressing an extension of RSA's utility without affecting its security. For the secure versions of RSA discussed by Katz and Lindell, such as RSA PKCS and RSA-OAEP, we propose the same basic approach that will be discussed next, that, to consider the message m a rational number and replace it by its corresponding Hensel code h.

RSA operates over the integers. If one wants to use RSA to encrypt any data that is not in integer form, then a mapping from any other format to integer form is required. We show that Hensel codes can be used to solve this problem without compromising RSA properties.

Definition 9. Hensel codes with single existing prime Let

_(p) be a set of order-N Farey fractions. Then, p is chosen to encode α=a/b∈

_(p) where N=└√{square root over (p/2)}┘. The Hensel encoding is given by h=H (p, a/b). The ciphertext c is computed as c=h^(e) mod n. This scheme preserves the multiplicative homomorphism in the original textbook definition of RSA since p is a factor of n.

Remark 3. According to Definition 9, the message space is reduced from {0, . . . , n−1} to {0, . . . , p−1}.

Remark 4. Because p is needed to encode m∈

as h∈

_(p), the encryption scheme is no longer a public-key one, instead, it is a private-key encryption scheme.

Example 13. Let e=17, p=211. q=199, n=41989, ϕ(n)=41580 and d=22013. Let α=9/7 be the fraction we want to encrypt. We proceed as follows: h=H(p,α)=H(211,9/7)=152 c=h ^(e) mod n=152¹⁷ mod 41989=35864  Eq. 85 Decryption is computed as follows: h=c ^(d) mod n=35864²²⁰¹³ mod n=152 α=H ⁻¹(p,h)=9/7  Eq. 86

Definition 10. Hensel codes with public modulus Let

_(N) be a set of order-N Farey fractions for any given N=└√{square root over (n/2)}┘. We use n=pq to encode α=a/b∈

_(N) so the Hensel encoding is given by h=ab⁻¹ mod n. The ciphertext c is computed as c=h^(e) mod n.

Remark 5. According to Definition 10, the message space size is exactly the same as the standard RSA configuration, that is, |{0, . . . , n−1}|=n.

Remark 6. By using n to encode m∈

as h∈

_(n), the encryption scheme remains a public-key encryption scheme.

Example 14. Let e=17, p=211, q=199, n=41989, ϕ(n)=41580 and d=22013. Let α=9/7 be the fraction we want to encrypt. We proceed as follows: h=H(n,α)=H(41989,9/7)=23995 c=h ^(e) mod n=23995¹⁷ mod 41989=15608  Eq. 87 Decryption is computed as follows: h=c ^(d) mod n=15608²²⁰¹³ mod n=23995 α=H ⁻¹(n,h)=9/7  Eq. 88

Remark 7. The Hensel code function is homomorphic with respect to addition and multiplication. The RSA function is homomorphic with respect to multiplication. Since both functions are homomorphic with respect to multiplication, adding the Hensel code step to the RSA implementation will preserve the multiplicative homomorphism of RSA.

Example 15. Let e=23, p=227, q=173, n=39271, ϕ(n)=38872 and d=18591. Let α₁=4/5, a₂=7/6, and n be used to compute the Hensel code of α₁ and α₂. We have h₁H(n, a₁)=7855 and h₂=H (n, a₂)=32727. We compute c₁ and c₂ as c₁=h₁ mod n=2415 and c₂=h₂ mod n=20018. Let c₃ be the product of c₁ and c₂ such that c₃=c₁c₂ mod n=869. We compute h₃=c₃ ^(d) mod n=2619 and a₃=H⁻¹(n, h₃)=14/15. We then verify that a₁a₂=4/5·7/6=14/15=a₃.

The methods introduced are particularly interesting if a given encryption scheme is originally designed to work over the integers and is homomorphic with respect to addition and/or multiplication since they allow such encryption scheme to operate also with rational numbers while preserving any existing homomorphism.

4. Adding Randomness to Deterministic Algorithms

In 1984, Goldwasser and Micali introduced a new model of encryption, that is, the probabilistic (or randomized) encryption while remarking its superiority in computational complexity in comparison with its deterministic counterpart. All techniques used to address this problem result in some form of ciphertext expansion.

4.1 Randomized RSA

Once again, we use the RSA cryptosystem illustrate utilities provided by Hensel codes, this time, randomization. Our goal is to modify the RSA scheme in order to add randomization without affecting its multiplicative homomorphism. We propose two versions, one that is a private-key and another that is a public-key encryption scheme.

Definition 11. Let the randomized private-key RSA be defined as follows: given e, p, q, ϕ(n), d from the standard RSA configuration,

-   -   Enc is a probabilistic-polynomial time algorithm that, in order         to encrypt a message m∈         _(p), choose a uniform s∈{1, . . . , q−1} compute H_(g) ⁻¹((p,         q), (m, s)), then h=H (n, α), so the ciphertext c is given by         c=h_(e) mod n.     -   Dec is a deterministic-polynomial time algorithm that, given a         ciphertext c, we compute a=H¹(n, h) in order to retrieve m as         m=H (p, α).

Example 16. Let e=23, p=227, q=173, n=39271, ϕ(n)=38872, d=18591, the message m=16, and the random number s=179. We compute α, h and c as follows: First we compute a: α=H _(g) ⁻¹((227,173),(16,179))=123/107,  Eq. 89 then we compute h: h=123·107⁻¹ mod 39271=123·19452 mod 39271=36336.  Eq. 90 The ciphertext c is computed as: c=h ^(e) mod n=36336²³ mod 39271=20893.  Eq. 91 Decryption is computed as follows: we first recover h: h=c ^(d) mod n=20893¹⁸⁵⁹¹ mod 39271=36336,  Eq. 92 then we compute a: α=H ⁻¹(n,h)=H ⁻¹(39271,36336)=123/107,  Eq. 93 so we can finally recover m: m=ab ⁻¹ mod p=123·107⁻¹ mod 39271=123·157 mod 227=16.  Eq. 94

Remark 8. According to Theorem 10, we could simplify the encryption function to be: h=q(q ⁻¹ mod p)m+p(p ¹ mod q)s c=h ^(e) mod n  Eq. 95 however, in order to keep notation and strategy consistent with the remainder of this work, which include constructions with more than two primes, we favor generalization and express the computations in terms of single and multiple Hensel codes.

Remark 9. The randomization in Definition 11 is given by s. If s is uniformly random in the set {1, q−1}, then there will be q−1 possible values for h and c for every message m that is encrypted.

Example 17. Let p=227, q=173, n=39271. If the message m=23 and s=202, α=H_(g) ⁻¹((p,q), (m, s))=73/92 and h=H (n, a)=17502, thus c=h^(e) mod n=20747. If the same message is accompanied of s=234, α=H_(g) ⁻¹((p, q), (m, s))=67/72, h=H (n, α)=19091, hence c=h^(e) mod n=6900.

Definition 12. Let the randomized public-key RSA be defined as follows: given e, p, q, n, ϕ(n), d from the standard RSA configuration, and let two additional public primes x, y, xy<n be considered such that:

-   -   Enc is a probabilistic-polynomial time algorithm that, in order         to encrypt a message m∈         _(x), choose a uniform s∈{1, . . . , y−1} compute α=H_(g) ⁻¹((x,         y), (m, s)), then h=H (n, α), so the ciphertext c is given by         c=h^(e) mod xyn.     -   Dec is a deterministic-polynomial time algorithm such that,         given a ciphertext c, we compute α=H⁻¹(n, h) in order to         retrieve m as m=H(x, α).

Remark 10. Since x, y, n are public, only public information is required for encrypting, thus the proposed randomized RSA encryption scheme remains a public-key one and multiplicative homomorphic. If one is not interested in homomorphism, the encryption can be computed as c=h^(e) mod n.

Remark 11. Similar to what we discussed in Section 3, we are adding Hensel codes to the RSA recipe as a tool of representation, meaning, we are transforming a deterministic encryption scheme into a probabilistic one by representing a message m together with a random s as a 2-digit Hensel code (m, s), which is then represented as a Farey fraction α. As we discussed in Section 2.5, there is a unique Farey fraction α for each k-digit Hensel code with respect to k primes.

5. Distributed Computation

Bertsekas and Tsitsiklis compare the improvement in computing power brought by distributed computing systems, together with parallel computing, to a quantum leap. In fact, a growing interest in distributed architectures is transforming the way that systems, in general, are designed and maintained. It seems reasonable to believe that if there a computational advantage in allowing a certain operation to be outsourced to multiple independent computing units, that is, servers, IoT devices, virtual machines, threads, etc., then it would be even more valuable to have this same procedure executed in a privacy-preserving manner. To address this issue, we propose a fully-homomorphic encryption scheme designed to allow multiple parties to jointly and homomorphically compute an operation over assigned encrypted inputs. Here we will consider an operation as any combination of additions and multiplications. Examples of possible applications include parallel computing, multi-party computation and distributed systems.

We define the syntax of distributed private-key fully homomorphic encryption (FHE) scheme as follows:

Definition 13. A distributed private-key FHE scheme

=(Gen, Enc, Dec) is a tuple of efficient (i.e., probabilistic polynomial-time) algorithms with the following syntax:

-   -   The key-generation algorithm Gen takes as input the security         parameter 1^(λ) and a positive integer t that determines in how         many units the computation will be distributed and outputs a         private-key sk and a public evaluation key pk. The secret key         implicitly defines a ring         that will serve as the message space. We write this as (sk,         pk)←Gen (1^(λ), t).     -   The encryption algorithm Enc takes as input a secret key sk and         message m and outputs t ciphertexts (c₁, c_(t)). We write this         as (c₁, c_(t))←Enc (sk, m).     -   The decryption algorithm Dec takes as input a secret key sk and         a t ciphertexts (c₁, c_(t)) and output a message m. We write         this as m←Dec (sk, (c₁, c_(t))).     -   Addition and multiplication are computed such that, given (a₁, .         . . , a_(t))=Enc (sk, a) and (b₁, . . . , b_(t))=Enc (sk, b),         the distributed computation of a+b is computed as a_(i)+b_(i),         the distributed computation of a·b is computed as a_(i)·b_(i)         for all i, i=1 . . . t.

Correctness requires the following:

-   -   1. For all sk, k output by Gen, and all m∈         we have:         Dec(sk,Enc(sk,m))=m.  Eq. 96     -   2. For all (a_(t+1), . . . , a_(2t))←Enc (sk, a) and (b_(t+1),         b_(2t)) Enc (sk, b), when operations are computed at the Hensel         digit level, which we denote by (a_(t+1)ob_(t+1) mod pk, . . . ,         a_(2t)ob_(2t) mod pk) we have:         Dec(sk,Enc(sk,aob))=aob,  Eq. 97         where o∈{+,·}.

Definition 14. A distributed private-key FHE scheme

is secure if for a uniform m∈

, all (sk, pk)←Gen (1^(λ), t) and all (c₁, . . . , c_(t))←Enc (sk, m), no efficient adversary

can recover m by knowing only pk and (c₁, . . . , c_(t)).

5.1 Description of the Scheme

We now describe the distributed private-key FHE scheme.

Gen takes as input the security parameter 1^(λ) and a positive integer t that determines the number of computable units the scheme will distribute the computation to, chooses uniform λ-bit primes p₁, . . . , p_(t) and uniform dλ-bit primes p_(t+1), . . . , p_(2t), for a fixed positive integer d≥t. Set g :=Π_(i=1) ^(2t)p_(i). Output the secret key sk=(p₁, . . . , p_(2t)) and pk=g. The message space is

=

_(p1).

Enc takes as input sk and m∈

_(p1) and proceeds as follows:

-   -   1. Choose uniform random numbers s₂, . . . , s_(t) from         _(p2), . . . ,         _(pt), respectively.     -   2. Compute α=H_(g) ⁻¹((p₁, . . . , p_(t)), (h₁, . . . , h_(2t)),         where:         (h ₁ , . . . ,h _(t))=(m,s ₂ , . . . ,s _(t)).  Eq. 98     -   3. Compute (h_(t+1), . . . , h_(2t))=H_(g)((p_(t+1), . . . ,         p_(2t)), α).     -   4. Output (h_(t+1), . . . , h_(2t)).

Dec takes as input sk and (h_(t+1), . . . , h_(2t)), and proceeds as follows:

-   -   1. Compute α=H_(g) ⁻¹((p_(t+1), . . . , p_(2t)), (h_(t+1), . . .         , h_(2t))).     -   2. Compute m=H (p₁, α).     -   3. Output m.

Addition and multiplication are computed at the Hensel digit level reduced modulo g.

Theorem 12. For all sk output by Gen and all m∈

_(p1) we have: Dec(sk,Enc(sk,m))=m.  Eq. 99

Proof. The proof for Theorem 12 is the combination of the proofs for Theorem 10, which states that k-digit Hensel codes are equivalent to single-digit Hensel codes, Theorem 3, which states the correctness of the forward mapping of Hensel codes, and Theorem 4, which states the correctness of the backward mapping of Hensel codes. According to the definition of key-generation algorithm, Gen outputs t λ-bit primes and t dλ-bit primes where d≥t which satisfies correctness since in the first step of the encryption, the computation of α=a/b, that is α=H_(g) ⁻¹((p₁, . . . , p_(t)), (h₁, . . . , h_(2t))), will result on an order-N Farey fraction in

_(Π) _(i=1) _(t) _(p) _(i) where N is given by N=└√{square root over ((Π_(i=1) ^(t)p_(i))/2)}┘ and therefore: |a|≤N,0<|b|≤(Π_(i=1) ^(t) p _(i))/(N+1).  Eq. 100 In the second step of the encryption, a is transformed into t ciphertexts, that is, (h_(t+1), . . . , h_(2t)), using the dλ-bit primes, which is clearly exponentially larger than the first t λ and therefore allows correct encryption and decryption with a depth d for multiplications given that all a generated with t λ-bit primes will be encoded with t dλ-bit primes, so the depth d can be expressed in terms of bits as follows:

$\begin{matrix} {d = {\frac{{td}\;\lambda}{t\;\lambda}.}} & {{Eq}.\mspace{14mu} 101} \end{matrix}$

Theorem 13. For all (a_(t+1), . . . , a_(2t))←Enc (sk, a), (b_(t+1), . . . , b_(2t))←Enc (sk, b), and (a_(t+1)ob_(t+1) mod pk, . . . , a_(2t)ob_(2t) mod pk), we have: (a _(t+1) ob _(t+1) mod pk, . . . ,a _(2t) ob _(2t) mod pk)=Enc(sk,aob),  Eq. 102 and therefore, Dec(sk,Enc(sk,aob)=aob,  Eq. 103 where o∈{+,·}.

Proof. The proof for Theorem 13 is the combination of proofs for Theorem 10, which states that k-digit Hensel codes are equivalent to single-digit Hensel codes, and Theorem 9, which states the isomorphisms between order-N Farey fractions and their corresponding Hensel codes.

5.1.1 Security of the Scheme

The distributed private-key FHE scheme consists of computing an order-N Farey fraction α where N=└√{square root over ((Π_(i=1) ^(t)p_(i))/2)}┘, for a t-digit Hensel code (h₁, . . . , h_(t))=(m, s₂, . . . , s_(t)), then computing an additional t-digit Hensel code (h_(t+1), . . . , h_(2t)) using the primes p_(t+1), . . . , p_(2t) where the homomorphic computation will be conducted independently on each digit in (h_(t+1), . . . , h_(2t)) reduced mod g where g=Π_(i=1) ^(2t)p_(i). We show if one knows the order-N Farey fraction α and an integer k_(i) for each ciphertext in (h_(t+1), . . . , h_(2t)), then one can efficiently factor p_(t+1), . . . , p_(2t) and p₁ from g.

Recall that for all a/b in

_(p) a Hensel code h is computed as h=ab⁻¹ mod p, which can be rewritten as the following diophantine equation: a=bh+kp,  Eq. 104 and from Eq. 104 we can derive: b=(a−kp)/hk=(a−bh)/p,  Eq. 105 and it is clear that if one can compute the k associated with a/b and h, then computing p is as trivial as: p=(a−bh)/k.  Eq. 106

Lemma 7. Given a message m and its correspondent ciphertexts (h_(t+1), . . . , h_(2t)), if one can compute α and each (k_(t+1), k_(2t)) corresponding to each one of the t ciphertexts such that: (k _(t+1) , . . . ,k _(2t))=((bh _(t+1) −a)/p _(t+1), . . . ,(bh _(2t) −a)/p _(2t))  Eq. 107 then one can efficiently factor p_(t+1), . . . , p_(2t) and p₁ from g, which is the minimum required information for a total break of the scheme.

Proof. Recall that g=Π_(i=1) ^(2t)p_(i) and, each h_(i) in (h_(t+1), . . . , h_(2t)) is computed as (ab⁻¹ mod p_(t+1), . . . , ab⁻¹ mod p_(2t)) where α=a/b, which can be rearranged as: (h _(k+1) b−a=k _(k+1) p _(k+1) , . . . ,h _(2t) b−a=k _(2t) p _(2t))  Eq. 108 for some integers k_(t+1), . . . , k_(2t). Thus, if one can solve for a/b each k_(i) associate with each public h_(i) in: k _(t+1)=(bh _(t+1) −a)/p _(t+1) a=h _(t+1) b−kp _(t+1) b=(a+kp _(t+1))/h _(t+1) k _(2t)=(bh _(2t) −a)/p _(2t) a=h _(2t) b−kp _(2t) b=(a+kp _(2t))/h _(2t)  Eq. 109 and k₁=(bm−a)/p₁, then one can efficiently factor p_(t+1), . . . , p_(2t) and p₁ from g since: p _(i)=(bh _(i) −a)/k _(i) ,i=t+1 . . . 2tp ₁=(bm−a)/k ₁  Eq. 110

FIG. 2 is a flow chart of operations for a FHE distributed computation embodiment.

Hardware Implementation for a FHE Distributed Computation Embodiment (FIG. 1 )

FIG. 1 is a block diagram 100 of the hardware implementation for a Fully Homomorphic Encryption (FHE) system distributed computation embodiment. A source device 102 is connected over an electronic network/bus connection 106 to computational units 1 to t (110 to 114). The computational units 1 to t (110 to 114) are, in turn, connected to the destination device 104. In the embodiment shown in FIG. 1 , the source device 102 acts as the source of the distributed encrypted data 108 and the source device 102 sends the encrypted data 108 over the network/bus connection 106 to the computational units 1 to t (110 to 114) as the individual Hensel digit level for each computational unit 1 to t (110 to 114). The computational units 1 to t (110 to 114) perform arithmetic operations (addition or multiplication) on the corresponding individual Hensel digit level encrypted values and then sends the Hensel digit level encrypted results 108 to the destination device 104. The destination device 104 acts as a destination for the encrypted data 108 received from the network/bus connection 106. Generally, communications, including concealed/encrypted communications, are bi-directional such that the source 102, computational units 1 to t (110 to 114), and destination 104 devices may change roles as the encrypted data 108 source 102, computational unit 1 to t (110 to 114), and the encrypted data 108 destination 104 as is necessary to accommodate the transfer of data back and forth between the computing devices 102, 104, 110, 112, 114. Additionally, while the computing devices 102, 104, 110, 112, 114 are depicted as separate devices in FIG. 1 , the functionality of the source device 102, the computational units 1 to t (110 to 114) and the destination device 104 may be shared on a single computing system/device or among two or more computing devices as it is often desirable to conceal data when transferring data between components of a single device.

Further, as shown in FIG. 1 , the source device 102 appears to be a laptop computer and the destination device 104 appears to be a tablet device and the computational units 1 to t (110 to 114) are simply shown as basic computational blocks. Generally, any computing device capable of communication over any form of electronic network or bus communication platform 106 may be one or more of the source 102, the computational unit 1 to t (110 to 114) and destination 104 computing devices. Additionally, the source 102, computational unit 1 to t (110 to 114) and/or destination 104 computing devices may actually be the same physical computing device communicating over an internal bus connection 106 with itself, but still desiring to encrypt transferred data to ensure that an attacker cannot monitor the internal communications bus 106 to obtain sensitive data communications in an unencrypted format.

Various embodiments may implement the network/bus communications channel 106 using any communications channel 106 capable of transferring electronic data between the source 102, computational unit 1 to t (110 to 114) and destination 104 computing devices. For instance, the network/bus communication connection 106 may be an Internet connection routed over one or more different communications channels during transmission between the source 102, computational unit 1 to t (110 to 114) and destination 104 devices. Likewise, the network/bus communication connection 106 may be an internal communications bus of a computing device, or even the internal bus of a processing or memory storage Integrated Circuit (IC) chip, such as a memory chip or a Central Processing Unit (CPU) chip. The network/bus communication channel 106 may utilize any medium capable of transmitting electronic data communications, including, but not limited to: wired communications, wireless electro-magnetic communications, fiber-optic cable communications, light/laser communications, sonic/sound communications, etc., and any combination thereof of the various communication channels.

The various embodiments may provide the control and management functions detailed herein via an application operating on the source 102, computational unit 1 to t (110 to 114) and/or destination 104 computing devices. The source 102, computational unit 1 to t (110 to 114) and/or destination 104 computing devices may each be a computer or computer system, or any other electronic devices device capable of performing the communications and computations of an embodiment. The source 102, computational unit 1 to t (110 to 114) and/or destination 104 devices may include, but are not limited to: a general-purpose computer, a laptop/portable computer, a tablet device, a smart phone, an industrial control computer, a data storage system controller, a CPU, a Graphical Processing Unit (GPU), an Application Specific Integrated Circuit (ASI), and/or a Field Programmable Gate Array (FPGA). Notably, the first 102 and/or second 104 computing devices may be the storage controller of a data storage media (e.g., the controller for a hard disk drive) such that data delivered to/from the data storage media is always encrypted so as to limit the ability of an attacker to ever have access to unencrypted data. Embodiments may be provided as a computer program product which may include a computer-readable, or machine-readable, medium having stored thereon instructions which may be used to program/operate a computer (or other electronic devices) or computer system to perform a process or processes in accordance with the various embodiments. The computer-readable medium may include, but is not limited to, hard disk drives, floppy diskettes, optical disks, Compact Disc Read-Only Memories (CD-ROMs), Digital Versatile Disc ROMS (DVD-ROMs), Universal Serial Bus (USB) memory sticks, magneto-optical disks, ROMs, random access memories (RAMs), Erasable Programmable ROMs (EPROMs), Electrically Erasable Programmable ROMs (EEPROMs), magnetic optical cards, flash memory, or other types of media/machine-readable medium suitable for storing electronic instructions. The computer program instructions may reside and operate on a single computer/electronic device or various portions may be spread over multiple computers/devices that comprise a computer system. Moreover, embodiments may also be downloaded as a computer program product, wherein the program may be transferred from a remote computer to a requesting computer by way of data signals embodied in a carrier wave or other propagation medium via a communication link (e.g., a modem or network connection, including both wired/cabled and wireless connections).

Operational Flow Chart for a FHE Distributed Computation Embodiment (FIG. 2 )

FIG. 2 is a flow chart 200 of operations for a FHE distributed computation embodiment. The arithmetic computation o is spread across a number t computational units 206 of the private-key Fully Homomorphic Encryption (FHE) system, where t is at least 2. At process 208, the source computing device 202 generates a secret key sk comprised of prime numbers p₁ . . . p_(2t) and public evaluation key pk equal to g of a g-adic number system. At process 210, the source computing device 202 chooses random numbers sa₂ . . . sa_(t) for a message m_(a) and random numbers sb₂ . . . sb_(t) for a message m_(b). At process 212, the source computing device 202 computes rational number α_(a) as a g-adic number inverse H_(g) ⁻¹ with the prime numbers p₁ . . . p_(t) and Hensel codes ha₁ . . . ha_(t) where the Hensel codes ha₁ . . . ha_(t) are the message m_(a) and the random numbers sa₂ . . . sa_(t), and computes rational number α_(b) as a g-adic number inverse H_(g) ⁻¹ with the prime numbers p₁ . . . p_(t) and Hensel codes hb₁ . . . hb_(t) where the Hensel codes hb₁ . . . hb_(t) are the message m_(b) and the random numbers sb₂ . . . sb_(t). At process 214, the source computing device computes Hensel codes ha_(t+1) . . . ha_(2t) as g-adic Hensel codes H_(g) from the prime numbers p_(t+1) . . . p_(2t) and the rational number α_(a) such that the Hensel codes ha_(t+1) . . . ha_(2t) are message m_(a) ciphertexts ca₁ . . . ca_(t), and computes Hensel codes hb_(t+1) . . . hb_(2t) as g-adic Hensel codes H_(g) from the prime numbers p_(t+1) . . . p_(2t) and the rational number α_(b) such that the Hensel codes hb_(t+1) . . . hb_(2t) are message m_(b) ciphertexts cb₁ . . . cb_(t). At process 216, the source computing device 202 sends each Hensel digit of said ciphertexts ca₁ . . . ca_(t) and each Hensel digit of said ciphertexts cb₁ . . . cb_(t) to corresponding computational units 1 . . . t (206), respectively.

At process 218, each computational unit i of computation units 1 . . . t (206) performs arithmetic function ca_(i) ocb_(i) to obtain encrypted result cr_(i) corresponding to said computational unit i. The arithmetic function o is one of addition or multiplication. Also, the arithmetic function o is computed at a Hensel digit level reduced modulo g. At process 220, each computational unit i of computation units 1 . . . t (206) sends the encrypted result cr_(i) that corresponds to the computational unit i of the computational units 1 . . . t (206) to a destination computing device (204).

At process 222, the destination computing device 204 computes a result rational number α_(r) as a g-adic number inverse H_(g) ⁻¹ with the prime numbers p_(t+1) . . . p_(2t) and the encrypted results cr₁ . . . cr_(t) as Hensel codes for the g-adic number inverse H_(g) ⁻¹. At process 224, the destination computing system 204 computes a result message m_(r) as Hensel Code H with the prime p₁ and the result rational number α_(r) such that result message m_(r) is equal to arithmetic function message m_(a) o message m_(b).

The foregoing description of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and other modifications and variations may be possible in light of the above teachings. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application to thereby enable others skilled in the art to best utilize the invention in various embodiments and various modifications as are suited to the particular use contemplated. 

What is claimed is:
 1. A method for distributing an arithmetic computation o across a number t computational units of a private-key Fully Homomorphic Encryption (FHE) system, where t is at least 2, the method comprising: generating by a source device a secret key sk comprised of prime numbers p₁ . . . p_(2t) and public evaluation key pk equal to g of a g-adic number system; choosing by said source device random numbers sa₂ . . . sa_(t) for a message m_(a); computing by said source device rational number α_(a) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes ha₁ . . . ha_(t) where said Hensel codes ha₁ . . . ha_(t) are said message m_(a) and said random numbers sa₂ . . . sa_(t); computing by said source device Hensel codes ha_(t+1) . . . ha_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(a) such that said Hensel codes ha_(t+1) . . . ha_(2t) are message m_(a) ciphertexts ca₁ . . . ca_(t); choosing by said source device random numbers sb₂ . . . sb_(t) for a message m_(b); computing by said source device rational number α_(b) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes hb₁ . . . hb_(t) where said Hensel codes hb₁ . . . hb_(t) are said message m_(b) and said random numbers sb₂ . . . sb_(t); computing by said source device Hensel codes hb_(t+1) . . . hb_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(b) such that said Hensel codes hb_(t+1) . . . hb_(2t) are message m_(b) ciphertexts cb₁ . . . cb_(t); sending by said source device each Hensel digit of said ciphertexts ca₁ . . . ca_(t) and each Hensel digit of said ciphertexts cb₁ . . . cb_(t) to corresponding computational units 1 . . . t, respectively; performing at each computational unit i of said computational units 1 . . . t arithmetic function ca_(i) o cb_(i) to obtain encrypted result cr_(i) corresponding to said computational unit i; sending by each of said computational units 1 . . . t said corresponding encrypted result cr_(i) to a destination device; computing by said destination device a result rational number α_(r) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p_(t+1) . . . p_(2t) and said encrypted results cr₁ . . . cr_(t) as Hensel codes for said g-adic number inverse H_(g) ⁻¹; and computing by said destination device a result message m_(r) as Hensel Code Generation H with said prime p₁ and said result rational number α_(r) such that result message m_(r) is equal to arithmetic function message m_(a) o message m_(b).
 2. The method of claim 1 wherein said arithmetic function o is one of group of arithmetic functions chosen from: addition and multiplication.
 3. The method of claim 1 wherein said arithmetic function o is computed at a Hensel digit level reduced modulo g.
 4. A private-key Fully Homomorphic Encryption (FHE) system that distributes an arithmetic computation o across a number t computational units, where t is at least 2, the private-key FHE system comprising: a source device, wherein said source device further comprises: a key generation subsystem that generates a secret key sk comprised of prime numbers p₁ . . . p_(2t) and public evaluation key pk equal to g of a g-adic number system; a random number selection subsystem that chooses random numbers sa₂ . . . sa_(t) for a message m_(a) and random numbers sb₂ . . . sb_(t) for a message m_(b); a message value to rational number subsystem that computes rational number α_(a) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes ha₁ . . . ha_(t) where said Hensel codes ha₁ . . . ha_(t) are said message m_(a) and said random numbers sa₂ . . . sa_(t), and computes rational number α_(b) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p₁ . . . p_(t) and Hensel codes hb₁ . . . hb_(t) where said Hensel codes hb₁ . . . hb_(t) are said message m_(b) and said random numbers sb₂ . . . sb_(t); an encryption subsystem that computes Hensel codes ha_(t+1) . . . ha_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(a) such that said Hensel codes ha_(t+1) . . . ha_(2t) are message m_(a) ciphertexts ca₁ . . . ca_(t), and computes Hensel codes hb_(t+1) . . . hb_(2t) as g-adic Hensel codes H_(g) from said prime numbers p_(t+1) . . . p_(2t) and said rational number α_(b) such that said Hensel codes hb_(t+1) . . . hb_(2t) are message m_(b) ciphertexts cb₁ . . . cb_(t); a ciphertext Hensel digit send subsystem that sends each Hensel digit of said ciphertexts ca₁ . . . ca_(t) and each Hensel digit of said ciphertexts cb₁ . . . cb_(t) to corresponding computational units 1 . . . t, respectively; said computational units 1 . . . t, wherein each of said computational units 1 . . . t further comprises: an arithmetic function subsystem that performs at each computational unit i of said computational units 1 . . . t arithmetic function ca_(i) o cb_(i) to obtain encrypted result cr_(i) corresponding to said computational unit i; an encrypted result send subsystem that sends said encrypted result cr_(i) that corresponds to said computational unit i of said computational units 1 . . . t to a destination device; and said destination device, wherein said destination device further comprises: a result rational number computation subsystem that computes a result rational number α_(r) as a g-adic number inverse H_(g) ⁻¹ with said prime numbers p_(t+1) . . . p_(2t) and said encrypted results cr₁ . . . cr_(t) as Hensel codes for said g-adic number inverse H_(g) ⁻¹ and a Hensel code result message recovery subsystem that computes a result message m_(r) as Hensel Code Generation H with said prime p₁ and said result rational number α_(r) such that result message m_(r) is equal to arithmetic function message m_(a) o message m_(b).
 5. The private-key FHE system of claim 4 wherein said arithmetic function o is one of group of arithmetic functions chosen from: addition and multiplication.
 6. The private-key FHE system of claim 4 wherein said arithmetic function o is computed at a Hensel digit level reduced modulo g. 